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ABSTRACT 


X-  H  J* 

This  report  describes  an  interim  system  for  measurement  of 

f1  A 

the  reliability  of  the  D-Series  Atlas  weapon  system.  Operational 
site  and  PMR  Category  III  data  are  used  for  calculation  of^JRelia- 
bility JPfend Jkidices  to  the  subsystem  level  in  the  standby,  count¬ 
down  and  flight  modes.  A  method  for  calculating^ApparenJ^Alert 
BLeadiness^robability  from  the  same  data  is  given.  Data  sources 
are  identified  and  qualified,  and  data  collection  and  processing 
methods  are  discussed.  Sample  exercises  based  on  post-Golden 
Ram  data  are  contained  in  Secret  Addendum  A ,  STL  6301-6269- 
RZ-000,  of  this  report. 
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1.  INTRODUCTION 


This  report  presents  the  results  of  an  AFBSD-directed  study  to 
develop  a  workable  reliability  measurement  system  for  the  D~Series  Atlas 
Weapon  System.  Specific  direction  is  set  forth  in  a  letter  from  BSD  dated 
29  November  1961,  Authority  for  this  direction  is  based  upon  AF  Contract 
04(694)- 3,  A  major  proviso  of  the  direction  given  was  that  the  present 
Air  Force  data  collection  system  was  to  be  disturbed  as  little  as  possible. 
The  measurement  system  submitted  in  this  report  is  so  designed.  Also 
consistent  with  the  cited  directive,  the  models  are  carried  to  the  subsystem 
level.  Implementation  methods  are  described,  but  further  refinement  is 
required  to  permit  automation  of  data  collection,  processing  and  analysis. 
The  study  can  be  extended  to  develop  equations  which  would  give  reliability 
to  one  level  below  the  subsystem  level  as  is  being  done  during  Category  II 
testing  for  the  E  and  F  Series  Atlas.  However,  these  equations  require 
data  beyond  that  which  are  routinely  available  at  the  base.  For  this  reason, 
only  those  equations  which  are  consistent  with  currently  available  data  are 
presented  herein.  Further  discussion  of  the  more  sophisticated  method  is 
contained  in  STL  proposal  No.  1224,  dated  25  May  1962. 

The  primary  objective  of  this  study  was  to  devise  a  measurement 
system  and  supporting  analytical  methods  which  would  permit  continued 
assessment  of  weapon  system  and  subsystem  reliabilities  in 
various  operating  modes.  The  development  of  mathematical  expressions 
for  weapon  system  reliability  is  a  relatively  straightforward  analytical 
task  which  can  be  carried  to  virtually  any  level  of  detail;  however,  to  be 
practical,  the  measurement  system  must  be  such  that: 

a)  The  complexity  of  the  equations  does  not  exceed 
the  computation  capability  of  existing  facilities 

b)  The  requirements  of  the  equations  are  consistent 
with  available  data. 

With  these  objectives  in  mind,  and  consistent  with  the  cited  direction, 
it  became  evident  early  in  the  study  that  absolute  reliability  measurement 
would  not  be  a  practical  goal  of  the  interim  system.  Instead,  a  direct 
means  of  obtaining  a  trend  index  of  reliability  which  can  be  implemented 
under  present  data  collection  concepts  was  devised.  While  the  Reliability 
Trend  Index  (RTI)  is  not  an  absolute  measure  of  reliability,  it  will  provide 
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valuable  indications  of  relative  reliabilities  among  the  major  subsystems 
and  serves  as  a  significant  step  toward  eventual  development  of  an  absolute 
measure  of  reliability. 

Recognizing  that  executive  management  responsibility  for  this  weapon 
system  is  in  the  process  of  being  transferred  from  AFSC  to  AFLC,  the 
measurement  system  is  presented  in  sufficient  detail  to  minimize  transi¬ 
tionary  difficulties  which  might  otherwise  occur. 

2.  SUMMARY 

The  method  selected  for  the  interim  reliability  measurement  system 
for  the  O-series  Atlas  consists  of  the  direct  application  of  success/trial 
data.  While  more  exact  methods  are  mathematically  feasible,  they  are  not 

* 

practical  in  light  of  the  types  of  data  presently  available.  As  discussed  in 
Section  4.  1,  available  data  lack  time  correlation;  thus,  failure  rate  deduc¬ 
tions  would  be  highly  speculative.  It  is  therefore  considered  wise  to  con¬ 
fine  the  measurement  and  expression  of  reliability  to  success/trial  ratios 
for  this  interim  system. 

The  equations  are  applied  according  to  the  major  modes  of  weapon 
system  operation  (i.e.,  standby,  countdown,  and  flight)  since  specific  and 
different  operating  dynamics  are  associated  with  each  mode.  Standby  data 
are  gathered  from  maintenance  records.  The  number  of  days  on  which 
failures  have  occurred  in  any  subsystem  (to  be  defined  later)  are  noted. 
Further  data  are  acquired  which  would  indicate  the  number  of  days  on  which 
a  particular  subsystem  was  declared  good.  This  is  obtained  by  subtracting 
from  the  total  number  of  days  available  on  all  launchers  the  days  noted 
above,  plus  those  days  required  for  repair,  MOCP,  and  scheduled  down¬ 
time.  These  data,  when  inserted  into  the  proper  equations  will  give  the 
Reliability  Trend  Indices  during  standby.  The  sources  are  listed  in  detail 
in  Section  4.  1  of  this  report. 

To  obtain  d^ta  for  the  countdown  Reliability  Trend  Index,  records  of 
post -Golden  Ram  launch  countdowns  are  analyzed  and  the  number  of  suc¬ 
cessful  countdowns  are  noted.  These  are  then  divided  by  the  total  number 
of  countdowns  attempted  to  obtain  the  countdown  Reliability  Trend  Index. 

If  complete  operation  of  a  given  subsystem  is  not  demanded  during  a  given 
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countdown,  that  countdown  ia  rejected  in  calculating  the  countdown 
reliability  by  subayatem. 

To  obtain  data  for  flight  Reliability  Trend  Indicea,  all  poat 'Golden 
Ram  missile  flight  records  are  reviewed.  In  case  of  flight  failure,  the 
deliquent  subayatem(a)  are  noted.  The  technique  used  above  for  obtaining 
the  countdown  Reliability  Trend  Index  is  again  used  to  obtain  the  flight 
Reliability  Trend  Index. 

Using  available  data,  the  Atlas  D  Interim  Reliability  Models  for 
standby,  countdown  and  flight  have  been  exercised.  The  calculations  and 
their  results  are  contained  in  the  Secret  Addendum  A  to  this  report.  It  is 
to  be  noted  that  this  is  a  sample  calculation  based  on  limited  data.  Its 
primary  purpose  is  to  demonstrate  the  workability  of  the  models,  and  the 
results  should  not  be  considered  as  more  than  initial  Reliability  Trend 
Indices. 

Continued  application  of  the  techniques  and  analyses  described  herein 
will  in  time  provide  Reliability  Trend  Indices  at  higher  confidence  levels. 
To  obtain  absolute  reliability  measurement  some  definite  actions  are  re¬ 
quired,  especially  with  regard  to  data  acquisition.  Expansion  of  the 
models  to  accommodate  a  more  precise  measurement  system  is  a  fairly 
straightforward  analytical  task  as  discussed  in  STL  proposal  number  1224, 
dated  25  May  1962. 

3.  QUALIFICATIONS  AND  LIMITATIONS 

The  interim  reliability  measurement  system  presented  herein  will 
provide  the  best  possible  indices  of  reliability  consistent  with  the  types 
and  quantity  of  data  that  are  presently  available.  However,  the  system 
has  definite  limitations  and  must  be  qualified  accordingly. 


Prior  data  are  not  considered  valid  because  of  the  extensive  configuration 
changes  resulting  from  Golden  Ram. 

Flights  were  made  from  VAFB, 
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The  system  presented  herein  provides  the  apparent  rather  than  the 
absolute  reliability  o£  the  weapon  system.  In  other  words  *  it  does  not  take 
into  account  (a)  the  probability  of  calling  a  good  system  bad,  (b)  the  proba¬ 
bility  of  calling  a  bad  system  good,  (c)  effectiveness  of  repair,  (d)  the 
adequacy  of  test  coverage,  and  (e)  running  time.  Valid  results  in  these 
areas  would  call  for  tests  and  data  beyond  the  scope  of  present  Category  III 
plans.  The  implications  of  these  assumptions  are  discussed  in  Section  4.3. 
Another  factor  to  be  considered  is  the  accuracy  of  data  used  to  compute  the 
RTI.  There  is  presently  no  method  of  establishing  data  validity. 

In  accordance  with  AFBSD  direction,  the  interim  measurement  sys¬ 
tem  is  limited  to  the  subsystem  level.  For  the  present,  this  depth  is  con¬ 
sidered  to  be  most  practical.  The  use  of  a  measurement  system  based  on 
subordination  below  the  subsystem  level  would  require  some  refinement  of 
reporting  practices. 

The  amount  of  applicable  data  presently  available  is  somewhat  limited. 
Although  the  D-series  Atlas  has  beenin  operational  status  for  several  years, 
data  acquired  before  Golden  Ram  are  not  considered  valid  because  of  the 
extensive  configuration  changes  resulting  from  the  program.  This  factor 
further  substantiates  the  wisdom  in  not  exceeding  the  subsystem  level  of 
detail  for  the  present. 

As  discussed  in  Section  4.  1,  there  are  certain  limitations  with  re¬ 
gard  to  data  acquisition  and  transmission  in  general.  Data  are  routed  to 
various  locations,  and  no  central  collection  point  is  maintained.  This 
situation  presently  precludes  automation  of  the  measurement  system,  but 
can  be  corrected  by  including  all  squadron  level  reliability  data  in  the  Air 
Force  Data  Control  System  through  provision  of  key  punch  information  of 
all  pertinent  data. 

In  summary,  the  major  qualifications  are: 

a)  It  does  not  account  for  probabilities  of  false  alarm,  failure 
detection  error,  repair  effectiveness,  or  test  coverage 

b)  There  is  no  means  of  establishing  the  validity  of  reported 
data 

c)  Maximum  depth  is  at  the  subsystem  level 

d)  The  amount  of  available,  pertinent  data  is  limited 

e)  Data  collection  procedures  require  some  refinement 
(see  Section  4.  2)  to  permit  automation  of  the  measure¬ 
ment  system. 
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4.  DISCUSSION 


This  section  discusses  the  proposed  reliability  measurement  system 
starting  with  a  consideration  of  the  existing  data  sources*  Next  is  shown 
the  application  of  the  existing  data  system  to  reliability  measurement. 
Then  the  proposed  reliability  measurement  system  is  briefly  outlined  in  a 
step  by  step  fashion.  Finally,  the  actual  models  and  equations  are  pres¬ 
ented  and  discussed.  A  sample  exercise  is  given  in  Addendum  A  to  this 
report. 

4.  1  Data  System 
4.  1.  1  Data  Sources 

4.  1.  1.  1  For  Reliability  Trend  Index  During  Standby.  The  first  of  the 
following  lists  comprises  forms  specified  in  AFM  66-1,  which  are  the 
basic  sources  of  data  for  the  Reliability  Trend  Index  during  standby. 
Following  that  is  a  second  list  of  data  sources  which  may  be  used  to  cor¬ 
roborate  the  data  in  the  first  list,  or  to  aid  in  directing  the  attention  of 
the  data  collector  to  specific  time  periods  and  trouble  areas* 

a)  List  of  Direct  Data  Sources  (AFM  66-1) 

AFTO  209  Gives  time  assigned  to  delayed  maintenance 
action  and  tends  to  summarize  AFTO  210 

AFTO  210  Includes  discrepancies  and  corrective  action 
on  nonrecoverable  parts  and  is  used  to  docu¬ 
ment  the  removal  of  a  part 

AFTO  211  Includes  discrepancies  and  corrective  action 
on  a  recoverable  part  and  is  used  to  identify 
components  by  part  number 

AFTO  212  Used  to  document  Time  Compliance  Technical 
Orders  (TCTO) 

b)  List  of  Corroborative  Data  (generally  SAC  originated) 

V-l  Summarizes  the  sorties  in  Emergency  War 

Order  Readiness  (EWO)  or  out  ofEWO  and 
give 8  day  and  general  reason  for  being  out 
of  EWO 

V-14  Has  similar  breakdown  asV  -  l's  and  can  serve 

as  a  source  of  correlation 
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1-AFA-l  Gives  further  breakdown  of  V- 1  information 

such  as  reason  for  being  out  of  EWO,  reasons 
for  Missile  Out  of  Commission  for  Parts 
(MOCP),  unscheduled  maintenance,  etc. 

U-82  Basically  provides  a  time  picture  of  weapon 

system  at  the  launcher  level  in  or  out  of 
EWO,  and  reason  for  being  out  and  time  out. 

At  present,  the  V- 1 ,  V-14  and  1-AFA-l  data  are  being  reviewed  by  STL 
on  a  2^-day  delay  basis.  All  other  data  are  available  without  delay.  The 
209-212  AFTO  forms  are  cards  which  are  filled  out  by  the  Chief  of 
Maintenance  at  each  squadron  to  record  all  maintenance  actions,  many 
of  which  may  not  be  critical  enough  to  affect  the  calculation  of  the  Reliability 
Trend  Indices.  These  cards  will  indicate  the  days  of  occurrence  of  mal¬ 
function  in  any  part  (which  may  then  be  assigned  to  the  subsystem),  the 
maintenance  action  taken,  the  length  of  time  to  complete  the  action,  and 
the  day  on  which  the  system  was  returned  to  operational  status.  Consid¬ 
erable  engineering  judgement  is  required  in  reviewing  these  forms  to 
sort  out  the  pertinent  data. 

4.  1.1.2  For  Reliability  Trend  Index  During  Countdown.  The  AFM  66-1 
data  control  system  contains  no  means  for  analyzing  and  recording  relia¬ 
bility  data  from  countdowns.  Data  are  required  from  these  exercises  in 
order  to  determine  the  Reliability  Trend  Index  for  this  mode.  A  countdown 
form  (Figure  1)  has  been  devised  by  STL  in  conjunction  with  SAC  field 
personnel.  It  relates  time  during  countdown  to  the  occurrence  of  certain 
significant  events.  From  this  can  be  determined  the  contribution  of  each 
subsystem  to  the  success  or  failure  of  the  countdown.  At  present  these 
forms  have  no  official  significance.  The  statistical  summary  forms 
developed  by  SACPO,  Vandenberg  as  part  of  the  Category  III  Test  Pro¬ 
gram  were  reviewed,  A  modified  version  of  the  countdown  statistical 
summary  form  is  currently  being  used  (unofficially)  by  STL  as  part  of 
the  means  of  implementing  the  Interim  Reliability  System.  This  form  is 
official  only  during  Category  III  testing.  However,  all  Category  II  testing* 
maintenance  exercising  and  inspection  as  previously  planned  have  been 
suspended  for  Operation  Shakedown.  It  is  recommended  that  Operation 
Shakedown  data  be  used  for  the  calculation  of  the  Reliability  Trend  Index 
during  countdown,  using  the  data  format  shown  in  Figure  1.  An  example 
of  the  use  of  this  form  is  given  in  Addendum  A. 
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Exercise — <24  Hour  Clock) 


Figure  1.  DP  L./ Countdown  Data  Form 


1.  State  holds  scheduled  prior  to  start  of  operation. 


2.  State  actual  holds  incurred  during  the  operation. 

3.  List  all  OG^  or  missile  subsystems  not  operative  during  this  operation  but 
normally  required, 

4.  Were  any  errors  incurred  because  of  inadequate  technical  orders? 

(if  yes ,  explain)  _ 

5.  Could  this  operationThave  adequately  supported  a  real  launch  attempt  7 
(If  no  i  explain) 

T!  List  all  personnel  errors,  when  each  occurred  and  time  delays  resulting 
from  these  errors. 

7.  List  status  of  K-75  configuration  control  report. 


8. 


9. 

10. 


12. 


13. 


14. 


15. 


16. 


17, 


18. 


19. 


20. 


21. 


22. 

23. 

24. 

25. 

26. 

27. 

28. 
29. 


Figure  1.  DPL/Countdown  Data  Form  (Continued) 
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4.  1 ,  1 . 3  For  Reliability  Trend  Index  During  Flight,  No  data  form  has 
been  prepared  for  flight  since  existing  GD/A  and  SAC  documentation  of 
Category  II/Category  III  flights  is  more  than  adequate  for  the  interim 
model. 

4.1.2  Reduction  and  Analysis 

4.  1.  2.  1  For  R8  (Standby  Reliability).  The  data  from  the  AFTO  209-212 
data  series  are  summarized  on  an  analysis  form  of  the  type  shown  in 
Figure  2.  One  of  these  forms  is  used  for  each  launcher  for  the  time 
period  involved.  It  must  be  emphasized  that  data  from  all  launchers  for 
the  same  time  period  must  be  utilized  in  order  to  obtain  a  Reliability  Trend 
Index.  Use  of  this  form  for  April  for  the  first  launcher  of  Complex  A  of 
the  SMS  549  is  shown  in  Addendum  A. 

4. 1.2. 2  For  R^  (Countdown  Reliability).  In  order  to  obtain  enough 
data  to  permit  a  reasonable  approximation  of  the  Reliability  Trend  Index 
during  countdown,  DPL's  are  to  be  analyzed  as  well  as  the  very  limited 
number  of  post-Golden  Ram  launch  countdowns.  In  analyzing  the  entire 
weapon  system  program,  it  was  concluded  that  the  DPL  is  the  exercise 
closest  to  the  countdown  capable  of  providing  adequate  data  to  permit  sta¬ 
tistically  meaningful  results.  In  using  the  DPL  for  countdown  data,  one 
precaution  must  be  observed;  i.  e.,  the  DPL  is  completed  at  generation 

of  the  engine  start  signal,  whereas  the  actual  launch  countdown  is  continued 
to  liftoff.  Hence,  DPL  acquired  data  will  not  include  the  engine  start 
sequence  or  the  holddown  and  release  actuation,  and  these  omissions  must 
be  taken  into  account  in  the  computation  of  the  countdown  Reliability  Trend 
Index.  As.  noted  earlier,  the  AFM  66-1  data  collection  system  contains  no 
provision  for  countdown  or  DPL  reporting  except  for  maintenance  records. 
In  consequence,  the  form  in  Figure  1  was  developed  to  supply  these  data. 

It  has  been  devised  so  that  the  easily  discernible  significant  events  may 
be  noted.  These  are  events  which  may  be  noted  from  the  Launch  Control 
Console,  the  Launch  Operation  Panels,  and  the  Launch  Analyst  Panel.  These 
events  may  be  related  readily  to  the  major  subsystems,  It  is  recommended 
that  this  form  be  used  to  implement  the  interim  data  collection  system. 

4.  1. 2.  3  For  Rf  (Flight  Reliability).  The  information  contained  in  the 
flight  test  summary  reports  prepared  by  GD/A  and  SAC  is  sufficiently 
summarized  to  be  used  directly  in  flight/ reliability  calculations. 
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Complex _  Squadron _  Missile  Serial  No. 

Date: 


Subsystem 

Electrical 

Flight  Control 

Guidance 

Hydraulics 

PLS 


Propulsion 

Pneumatic 

R/V 

Pyrotechnics 

Launcher 

ln2/he 

Direct  Support  RPIE 

Ground  Handling 
Equipment 

Communications 

Launch  Control 
and  Checkout 

Airframe 


Figure  2.  Data  Analysis  Form 
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4.  2  Application  of  the  System 
4.  2. 1  Present  System 


T 


This  section  describes  the  actual  application  of  the  interim  reliabil¬ 
ity  measurement  system.  To  demonstrate  the  workability  of  the  system, 
sample  exercises  were  conducted  as  a  part  of  this  study.  In  exercising 
the  data  collection,  data  reduction,  correlation  and  presentation  system, 
the  general  procedure  followed  the  logic  flow  diagram  of  Figure  3.  The 
calculations  of  Reliability  Trend  Indices  using  these  data  are  contained  in 
Addendum  A. 

Referring  to  Figure  3,  the  following  preliminary  steps  must  be  taken 
in  order  to  obtain  reduced  data  for  use  in  the  reliability  calculations. 

Step  1  The  DPL  form,  the  AFTO  No.  209,  210,  211,  212, 

T  and  E  tapes,  APCHE  tapes,  guidance  charts,  guid¬ 
ance  computer  tapes — the  AF-14  1AFA-1,  the  U-82, 
the  V-l  data,  the  training  flight  data,  were  all  reviewed 
for  the  purpose  of  establishing  the  missile  emplacement 
"out  of  EWO"  time. 

Step  2  After  culling  through  the  above  mentioned  reports,  the 
AFTO  Nos*  209,  210,  211,  and  V-l  reports  formed  the 
main  basis  from  which  the  "out  of  EWO”  time  was 
derived.  The  DPL  forms  were  also  used.  These  are 
covered  in  Steps  11  and  12. 

Step  3  The  V-l  reports  at  VAFB  are  always  used,  however 
due  to  SAC  policy  they  must  be  20  days  old  before 
STL  can  review  them.  From  the  V-l  reports  (which 
are  TWX's  dispatched  from  squadron  control  center 
anytime  there  is  a  change  in  missile  emplacement 
EWO  status,  according  to  parameters  established  by 
SAC  policy  -  Example:  if  it  takes  a  half  hour  or  less  . 
to  fix,  don't  report  it).  Time  bar  graphs  for  each 
emplacement  are  plotted  from  the  V-l  reports  and 
these  are  used  as  a  source  of  correlation  against 
maintenance  data  derived  elsewhere. 

Step  4  In  most  cases  where  the  AFTO  No.  209  is  used,  it  is 
not  necessary  to  use  210  or  211.  The  209  is  a  chrono¬ 
logical  summary  of  the  210*8  and  211's.  On  occasion 
the  210fs  and  211's  will  be  sifted  -  these  yield  main¬ 
tenance  information  at  a  subordinate  hardware  level, 
but  might  possibly  clarify  an  indecisive  point.  This 
is  done  by  hand  and  usually  a  two  man  team. 
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Figure  3.  Existing  Method  of  Data  Collection  and  Application 


Step  5 


Step  6 


Step  7 


Step  8 


Step  9 


Step  10 


Step  11 


Step  12 


The  maintenance  data  derived  from  the  AFTO  No.  209 
forms  covered  all  the  functional  subsystems  with  the 
following  exceptions:  Pyrotechnics,  re-entry  vehicle, 
communications  (incomplete).  The  data  on  the  209  forms 
were  considered  on  the  basis  of  whether  the  maintenance 
problem  reported  occurred  at  such  a  time  and  was  serious 
enough  in  nature  to  have  caused  the  missile  emplacement 
to  go  out  of  EWO — this  was  recorded  in  a  format  similar 
to  Figure  2,  Due  to  a  shortage  of  qualified  personnel, 
the  209  forms  relating  to  guidance  problems  were  copied 
and  returned  to  NAFB  for  analysis  there  and  subsequently 
these  were  handled  in  the  same  manner  as  the  other  infor¬ 
mation  on  the  Figure  2  forms. 

The  number  of  different  days  on  which  a  missile  emplace¬ 
ment  went  off  EWO  during  a  scanning  period  (this  period 
is  usually  30  days)  and  the  duration  of  downdays  that  the 
problem  incurred  would  be  reported  against  the  offending 
subsystem.  One  or  more  faults  in  the  same  day,  would 
be  regarded  as  one  fault  and  attributed  to  the  first  re¬ 
sponsible  subsystem.  To  resolve  any  question  as  to  which 
is  the  offending  subsystem  the  T.O.  21 -SM65D-06- 1  and 
-2  were  used. 

If  it  appears  that  either  individual  or  cumulative  main¬ 
tenance  problems  exceed  the  downtime  allowed  by 
policy  to  still  maintain  EWO  status,  then  the  V-l  time 
bars  are  used  as  a  source  of  correlation. 

This  Figure  2  data  is  then  returned  to  NAFB  from  all 
squadrons  in  the  Series  D  Atlas  weapon  system  where 
on  a  subsystem  basis  all  the  days  were  summed  on 
which  the  missile  emplacement  went  out  of  EWO. 

On  a  subsystem  basis  the  MOCP  or  TCTO  days,  etc.,  is 
subtracted  from  the  number  of  down  days  to  give  an 
accurate  downtime  as  a  result  of  a  specific  subsystem 
malfunction. 

On  a  subsystem  basis,  the  number  of  missile  days  avail¬ 
able  is  computed  by  subtracting  the  sum  of  the  scheduled 
and  the  unscheduled  down  days  from  the  number  of  days 
in  the  scanning  period. 

On  a  subsystem  basis  (and  using  the  time  criterion 
establishing  by  SAC  for  a  successful  DPL)  the  number 
of  trials  and  the  number  of  successes  are  determined. 

The  number  of  successful  subsystem  completions  during 
a  failed  DPL  are  determined  (this  is  accomplished  by 
a  knowledge  of  the  various  subsystem  times  to  comple¬ 
tion  during  a  normal  DPL). 
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Step  13  The  results  of  Steps  8  through  12  are  forwarded  for 

application  of  the  equations.  The  final  outputs  are  the 
reliability  of  each  subsystem  during  standby,  during 
countdown  (DPL),  the  reliability  of  all  subsystems 
during  standby  and  during  countdown  (DPL). 

SAC  V-l  data  for  the  Atlas  D  fleet  covering  the  period  January 
through  March  1962  were  obtained  and  analyzed  for  possible  application 
to  the  measurement  system.  A  substantial  screening  effort  was  required 
to  sort  out  usable  data.  April  data  were  taken  from  AFTO  209  forms  at 
Warren  AFB  and  AFTO  forms  209,  210,  and  211  at  Offutt  AFB.  In  the 
study  of  these  forms  the  following  observations  were  made: 

The  accuracy  of  the  66-1  data  appeared  to  be  somewhat  biased 
because  many  items  which  were  reported  as  detected  in  April  had  been 
carried  forward  to  May  with  no  solution  being  reported  in  April.  Conse¬ 
quently,  no  record  of  these  detections  or  downtimes  were  included  in 
April  reports.  Other  items  were  reported  as  having  failed  and  as  repaired 
two  or  three  times  during  the  month  of  April.  In  some  instances  these 
were  apparently  repetitions  of  the  same  problem  and  were  erroneously 
reported  as  failures  or  as  repaired.  Another  problem  encountered  was 
that  the  data  are  not  explicit  with  regard  to  effect  on  EWO  status.  Such 
items  as  guidance  receivers  or  transmitters  might  or  might  not  take  the 
site  out  EWO  depending  upon  their  degree  of  misalignment.  In  the  latter 
example,  the  weapon  system  was  given  the  benefit  of  the  doubt  and  align¬ 
ment  problems  were  not  reported  as  out-of-EWO  failures.  A  problem 
also  appeared  with  items  having  been  reported  out  for  maintenance  in 
March  and  reported  repaired  near  the  middle  of  April.  These  were 
recorded  as  being  out  of  EWO  until  the  time  repaired.  The  anomalies 
cited  above  could  cause  gross  distortion  of  the  Reliability  Trend  Index. 
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Time  bar  charts  were  drawn  from  the  V-i  reports  for  April  show¬ 
ing  the  reported  in  or  out  of  EWO  status  as  reported  to  SAC  through  the 
squadron  job  controller.  Next,  the  V-i  data  were  correlated  with  the 
AFTO  data  and  further  correlation  was  obtained  through  direct  contact 
with  responsible  maintenance  personnel  at  the  squadron  or  wing  levels. 
Data  for  this  correlation  effort  were  not  available  at  any  central  location, 
but  had  to  be  extracted  from  the  maintenance  and  EWO  status  records  at 
each  site.  Consequently,  a  study  was  made  of  current  data  transmission 
practices  in  order  to  establish  the  feasibility  of  a  fully  computerized  pro¬ 
gram  for  data  collection  and  reduction.  It  was  found  that  under  the  exist¬ 
ing  method  certain  subsystem  data  are  not  transmitted  to  SBAMA.  The 
deficient  areas  are: 

a)  Data  for  the  communication  subsystem.  All  of  this 
dalaTs  not  routecf  through  squadronT  records  but  on 
a  problem  selective  basis  goes  through  the  base 
Statistical  Services,  then  to  Memphis,  Tennessee, 
and  ultimately  to  Rome  AMA.  Some  selected  data 
are  transmitted  to  SBAMA. 

b)  Data  from  the  pyrotechnic  subsystem.  Pyrotechnics 
cannof  be  dynamically  tested  at  operational  sites, 
except  at  VAFB  in  conjunction  with  actual  flights. 

Some  information  regarding  the  reliability  of  this 
subsystem  is  apparently  available  through  GAMA 

at  Ogden,  Utah.  However,  it  appears  at  present 
that  considerable  more  work  is  required  on  this 
subsystem  to  obtain  complete  data. 

c)  The  warhead  and  re-entry  vehicle  subsystem.  Data  are 
being  recorded  at  the  squadron  level  ana  are  being  trans¬ 
mitted  to  SBAMA.  However,  this  is  a  very  small  portion 
of  the  total  available  data  because  many  of  the  problem 
areas  develop  at  the  S  and  I  Building  and  these  data  are 
sent  to  the  San  Antonio  Air  Materiel  Area.  Thus,  many 
faults  occurring  in  re-entry  vehicle  and  warhead  appear 
to  be  recorded  only  at  SAAMA  and  are  not  transmitted 

on  a  regular  basis  to  SBAMA. 

Pertinent  to  a  computerized  program  to  select  the  required  data 
from  that  submitted  by  the  operational  bases,  the  following  basic  data 
must  be  extracted  from  the  punched  cards  arriving  at  SBAMA: 


.J 
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AFTO  No b.  210,  211,  212 


Work  Unit  Code 
Date 

Missile  Number 
Part  Number 


Base,  BSAC 

Weapon  System 

Site  Work 
Center  Code 


Report  Number 

Action  Taken  Code 

Part  or  Component 
Serial  Number 


Almost  immediately  upon  the  turnover  of  the  Atlas  D  weapon  system 
to  SAC,  Operation  Shakedown  was  established.  This  will  create  a  con¬ 
siderable  amount  of  data  on  an  accelerated  basis  insofar  as  the  countdown 
is  concerned,  and  will  permit  calculation  of  Reliability  Trend  Indices  of 
high  confidence  for  the  countdown  mode  if  the  data  are  used. 

Data  for  calculation  of  the  Reliability  Trend  Index  for  flight  will  be 
limited  to  the  presently  planned  Category  III  flights  from  VAFB.  Thus  the 
Reliability  Trend  Index  will  be  based  on  a  limited  population. 

4.  2.  2  Proposed  System 

The  logic  flow  diagram  shown  in  Figure  4  is  the  proposed  automated 
data  reduction  system.  Listed  below  is  an  explanation  of  what  is  accom¬ 
plished  at  each  numbered  step. 

Step  1  SBAMA  receives  IBM  cards  or  card  images  on  magnetic 
tape.  At  present  data  is  not  available  for  the  pyrotech¬ 
nics,  R/V  and  communication  subsystems  because 
other  AMA's  have  prime  responsibility  for  these  sub¬ 
systems.  Negotiations  are  presently  being  held  to 
arrange  for  these  data  to  be  shipped  to  SBAMA  from 
these  AMA's. 

Step  2  Place  all  data  on  magnetic  in  card  image  format 
(22,  000  card  images  per  tape). 

Step  3  Delete  all  data  that  is  not  necessary,  that  is  items  that 
would  not  take  the  missile  out  of  EWO.  The  "Action 
Taken  Code"  will  be  used  for  this  purpose.  An  example 
of  this  is  Code  A  which  states,  "This  code  will  be  applied 
only  if  it  is  determined  that  a  deficiency  reported  by  the 
air  crew  or  maintenance  personnel  does  not  exist  or 
cannot  be  duplicated."* 


„ _  1 

]|(  ^ 
T.  O.  21 -SM65D-06- 1  and  -2,  Technical  Manual,  Work  Unit  Code  Manual, 

USAF  Model  SM65D,  Ballistic  Missiles,  dated  1  October  1961,  p.  vii. 
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1  Us  inf  Engineering  Judgment 
—  —  —  —  Presently  being  done  menus  My 

Figure  4  Prooosed  Reliability  Data  Gathering  and  Processing  Flow 


Step  4 


Steps  5 
and  6 


Steps  7 
and  8 


Step  9 


Step  10 


Step  1 1 


Step  12 


Step  1 3 
Step  14 


Correlate  AFTO  210,  211,  and  2 12  forms  for 
the  same  problem.  This  is  done  by  using  the 
Report  Number  (item  G  on  210  and  211  forms) 
and  the  Original  Report  Number  (Item  F  on  210 
and  211  forms). 

The  next  two  steps  are  done  to  arrange  the  data 
by  squadrons  and  then  by  sites  per  squadron. 

This  is  done  by  using  the  Work  Center  Code, 

Item  4  on  the  210  and  211  forms,  which  identi¬ 
fies  squadron  and  site  by  code. 

These  steps  are  used  to  group  the  data  by  site 
peculiar  and  missile  peculiar  subsystems.  This 
is  done  by  using  the  Work  Unit  Code,  Item  7  on 
the  210  and  211  forms.  The  Work  Unit  Code  con¬ 
sists  of  six  numerical  and  alphabetical  characters 
and  is  used  to  identify  the  system,  subsystem  ana 
component  that  was  worked  on  and  the  work  that 
was  done  (action  taken). 

Check  Work  Unit  Code  against  component  number 
to  verify  that  the  correct  Work  Unit  Code  was  used. 

Calculate  failures  for  each  subsystem.  Since  only 
those  items  that  would  cause  an  out  of  EWO  con¬ 
dition  are  listed,  the  other  data  being  eliminated  in 
Step  3,  all  that  is  required  is  to  sum  the  failures 
(inputs)  for  all  subsystems  per  site  and  then  sum 
for  all  sites. 

The  calculation  of  "down  days"  is  a  little  more 
complicated.  First  all  the  dates  on  the  V«1  forms 
must  be  converted  to  a  three  digit  number  so  they 
can  be  added  and  subtracted.  Sum  all  days  per 
subsystem  that  caused  the  missile  to  be  out  of  EWO, 
then  total  these  for  all  sites. 

Calculate  the  "good  days"  per  subsystem  by  sub¬ 
tracting  the  "down  days"  from  the  available  days, 
the  available  days  being  the  total  days  in  the  time 
period  under  consideration.  This  is  usually  one 
month. 

Apply  equations. 

Publish  monthly  and  cumulative  status  periodically 
in  the  format  shown  in  Figure  5. 

(See  sample  exercise  in  Addendum  A) 
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RELIABILITY  MATRIX  OUTPUT 


* 


Subsystems 

R 

8 . 

1 

\ 

si 

Rcdi 

\ 

R,  R, 
cdi  fi 

Electrical 

Flight  Control 

Guidance  f Non- Redundant 
^Redundant 

Hydraulic 

Propellant  Loading  System 
Propulsion 

Pneumatic 

R/V 

Pyrotechnics 

Launcher 

LN2/HE 

Direct  Support  RPIE 

Ground  Handling  Equipment 

Communications 

Launch  Control  and  C/O 
Airframe 

.  _  ..  ..  | 

1 

R'  =  R  tr  R 

■  g  »i 

R  =  ir  R 

8  .j 

8 

_ l 

. .  . — - - - '  T i 

R  ,  *  irR  , 
cd  cd, 

i 

I 

1 

Rf  =  w  Rf 

i 

RcdRf  *  wRf£  ^ 

Par  =  1  +  \Tr  1  Tt  s - day8 

See  page  38  for  definitions  of  symbols. 


Figure  5.  Format  for  Monthly  and  Accumulative  Reports 
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4.  3  Models  and  Equations 
4.3.1  Modela 


Starting  with  the  elementary  method  of  aucceaa /trial  ratio,  it  ia 
possible  to  expresa  reliability  in  various  mathematical  forma.  By  intro¬ 
ducing  time  correlation,  event  probabilities  can  be  expressed  as  failure 
rates,  and  more  sophisticated  reliability  expressions  are  thus  developed. 

For  this  interim  model,  however,  the  conventional  success /trial  method  is 
the  most  practical,  primarily  because  time -correlated  data  are  not  available. 
Because  of  the  unique  operating  stresses  associated  with  each  major  mode 
of  weapon  system  operation,  the  standby,  countdown,  and  flight  modes  each 
have  to  be  considered  separately  in  the  measurement  system. 


4.3.  1.  1  Flight  or  Countdown.  The  subsystem  is  determined  to  which 
one  can  attribute  the  failure  of  either  a  flight  or  a  countdown.  By  failure 
is  meant  preventing  the  countdown  or  flight  from  reaching  the  prescribed 
goal.  In  either  case,  the  Reliability  Trend  Index  is  calculated  in  the  same 
manner.  If  MiM  indicates  the  subsystem  and  "j"  indicates  the  mode  (either 
countdown  or  flight)  then 


(1) 


where  N,.  are  the  number  of  failed  exercises  (j)  attributable  to  the  i 

1 J  th 

subsystem  and  Mj  is  the  total  number  of  the  j  exercise.  In  the  case  of 

countdown,  any  subsystem  malfunction  which  prohibits  attainment  of  lift¬ 
off  within  a  prescribed  interval  is  considered  to  have  caused  the  failure 
of  the  countdown  and  the  subsystem  involved  is  so  charged.  In  the  case 
of  flight,  any  subsystem  malfunction  which  causes  the  flight  to  deviate 
beyond  3  CEP  from  the  target  is  considered  as  having  caused  a  failure 
of  the  flight  and  the  subsystem  involved  is  so  charged. 


Assuming  the  independence  of  the  subsystems,  it  is  possible  to  ob¬ 
tain  a  Reliability  Trend  Index,  which  is  given  by  the  following  equation 

R.  =TT  (2) 


'j 


i=  1 
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alternately 


(3) 


where 


for  ground  guidance. 


N 

M 


g 


g 


=  Number  of  failed  ground  guidance  exercises 
=  Total  number  of  ground  guidance  exercises 


n  =  Number  of  ground  guidance  sites  per  squadron 


(4) 


where  R^  is  the  weapon  system  Reliability  Trend  Index  during  either  count¬ 
down  or  flight  and  "k*  is  the  total  number  of  subsystems  involved,  n  indi¬ 
cates  the  product  rule. 


4*  3.  1.  2  Derivation  of  the  Equations  for  Standby  Reliability,  Obtaining  a 
Reliability  Trend  Index  for  the  standby  phase  is  conceptually  somewhat 
more  difficult  and  remote  than  for  the  other  two  phases.  In  the  previous 
cases,  there  were  specifically  defined  exercises  with  specific  goals. 
During  standby,  no  one  specific  exercise  exists  for  which  success  and 
failure  are  easily  definable.  A  definition  may  be  obtained  by  assuming 
that  the  standby  period  is  divided  into  a  series  of  24-hour  periods  and  that 
failure  and  success  are  defined  in  terms  of  the  completion  of  a  day  with 
either  malfunction  indication  or  no  malfunction  indication.  Since  this  day 
is  repeated  continuously  it  may  be  considered  a  test,  and  by  collecting  the 
number  of  days  on  which  a  malfunction  has  been  indicated  in  a  specific 
subsystem,  it  is  possible  to  obtain  a  Reliability  Trend  Index  for  that  sub¬ 
system.  Thus,  if  R  indicates  the  days  throughout  the  whole  force  and 
during  the  time  period  involved  on  which  a  specific  subsystem  has  been 
noted  as  having  failed  (either  through  monitoring,  special  inspections, 
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testing,  etc.),  and  if  is  defined  as  the  sum  of  these  days  during  the 
time  period  in  question  on  which  the  subsystem  has  been  declared  good  by 
the  monitoring  system,  special  inspection,  testing,  etc.,  then  the  Reliabil 
ity  Trend  Index  of  the  i**1  subsystem  during  standby  is  given 


N. 

1 


*  N.  T  D. 

i  1 


(5) 


This  heuristic  approach  may  be  placed^on  a  rigorous  basis  and  the  relation¬ 
ship  of  this  formula  to  time  and  the  failure  rate  distribution  may  be  shown 
by  the  following  considerations. 

Consider  a  basic  time  interval  of  fixed  length  t.  The  probability 
P^Jjr/fcQ  of  surviving  the  time  t*  given  that  the  equipment  enters  the 
interval  nonfailed,  is  called  the  reliability  Rfl  of  the  equipment  for  a 
time  r.  That  is 

P,  [t/g]  «  R,  [t]  «■) 


Let  there  be  a  total  of  M  intervals  of  length  t  in  a  greater  interval  of  length 
T,  at  the  commencement  of  which  the  equipment  is  nonfailed.  Let  there 
be  N  intervals  out  of  the  M  intervals  of  length  t  in  the  interval  T,  at  the 
commencement  of  which  the  equipment  is  nonfailed,  but  during  which  one 
or  more  failures  occur.  In  general 


Mt<T  (7) 

M  =  N  +  D  (8) 

N  =  Number  of  intervals  of  length  t  during  which  one  or 
more  failures  occur,  given  that  the  equipment  was 
nonfailed  at  the  start  of  the  interval. 

D  =  Number  of  intervals  of  length  t  which  the  equipment 
survives,  given  that  the  equipment  was  nonfailed  at 
the  start  of  the  interval. 

The  "less  than"  sign  arises  from  the  fact  that  during  some  of  the  intervals 
of  length  t  in  T  the  equipment  will  be  down  at  the  start  of  the  interval. 

All  such  t  must  be  eliminated  from  the  calculation,  hence  the  inequality. 
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The  probability  p£m,n])  of  obtaining  a  succession  of  exactly  N 
"bad*  intervals  out  of  a  total  of  M  intervals  is  given  by 

PCM,N]  s  N!  (M*-  N).'  f1  *  rb  [tJ)N  r8  [t]M'N  (9) 

where  it  is  explicitly  assumed  that  the  probability  of  calling  a  nonfail  ed 
system  bad  is  zero,  the  probability  of  calling  a  failed  system  good  is  zero, 
and  the  test  coverage  is  complete. 

For  convenience,  define 

L  £  log  P  [m,  n]  (10) 


Then  the  most  likely  value  of  ^  tJ  is  given  by  setting 


8L 

sr.H 


=  0 


and  solving  the  resulting  equation  for  Rg|\  J 


in  terms  of  M  and  N 


since 


8L 

M  -  N  - 

*  M  R  I 

si 

8R 

s' 

i  i 

i  -  r  | 
s' 

raw 

o-R.H-i 


(ii) 


(12) 


(13) 


it  follows  that  (12)  can  be  zero  only  if  the  numerator  is  zero.  Hence 


N 

D  +  N 


If  the  subscript  i  denotes  a  particular  subsystem 


N. 

TTTN. 

i  i 


(14) 


(15) 
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U  an  exponential  failure  distribution  is  assumed 


Hence 


(16) 


(17) 


Further,  for  an  arbitrary  time  period  of  length  T 


/  t\T  /t 
(.  •«  )  ■ 

f  N.  \VT 


(18a) 


(18b) 


Further,  if  all  subsystems  are  independent,  then  the  reliability  of  the  total 
system  becomes  for  k  subsystems 


R 

8 


(19) 


It  must  be  indicated  that  this  method  of  calculation  is  specifically  related 
to  the  hardware  reliability  and  has  no  direct  bearing  on  the  in- commission 
rate,  since  the  definition  specifically  omits  repair  days,  MOCP  days,  etc. 
The  malfunction  days  (N*)  and  the  days  declared  good  (D^)  are  counted 
over  the  entire  force  and  not  for  one  launcher;  hence,  the  total  launcher 
days  will  be  many  times  greater  than  the  total  calendar  days  and  will 
present  a  sizeable  statistical  sample. 
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The  Reliability  Trend  Indices  assume  that  the  means  of  discovering 
the  malfunctions  in  terms  of  monitoring,  checkouts,  special  inspections, 
etc. ,  are  both  all  inclusive  and  completely  valid;  nonetheless,  they  will 
prove  useful  in  determining  reliability  trends  and  identifying  problem 

areas. 

The  reliability  models  are  developed  by  applying  the  previous  equa- 
tions  to  the  logic  and  subsystems  concerned  in  accordance  with  the  mode 
of  operation  to  be  considered.  Thus,  the  equations  become  a  mathematical 
description,  or  model,  of  a  particular  system  under  specific  conditions. 
For  the  interim  model,  the  equations  are  applied  to  the  subsystem  level 
(e.g.,  autopilot,  guidance,  R/V,  propulsion,  propellant  loading  system, 
communications,  etc.).  The  assumption  is  made  that  the  product  rule  is 
valid,  i.  e.  ,  that  the  weapon  system  reliability  is  the  product  of  the  sub¬ 
system  reliabilities.  At  this  level,  the  assumption  is  reasonable,  since 
any  major  subsystem  failure  would  generally  result  in  mission  failure, 
whether  the  mode  be  standby,  countdown,  or  flight.  One  major  exception 
is  the  guidance  subsystem,  where  more  than  one  ground  guidance  station 
is  available  to  the  launch  complex.  This  "handover  capability”  as  it  is 
termed,  makes  the  ground  guidance  centers  redundant  with  respect  to  the 
launch  complexes  and  must  be  accounted  for,  provided  that  no  penalty  is 
exacted  for  the  delayed  reaction  time  which  is  incurred  by  handover.  This 
redundancy  is  handled  as  indicated  in  Equations  22,  23,  and  24  below.  On 
the  other  hand,  if  delayed  reaction  time  is  considered  to  be  a  failure,  then 
the  guidance  subsystem  is  handled  in  exactly  the  same  fashion  as  the  other 
subsystems,  i.e.  by  Equations  (20)  and  (21). 

a.  Reliability  Trend  Index  During  Standby 

1)  Reliability  Trend  Index  of  the  i**1  subsystem  for  a  time  t 
during  standby  (maximum  likelihood  estimate) 

R.i  W  *  1  -  fTTTS:  ,20> 

i  i 

t  s  Least  reporting  time  period  in  an  arbitrary  time 
period  of  length  Ts*.  in  all  cases  checked  to  date  t 
may  be  taken  as  one  day. 
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=  Number  of  time  periods  of  length  r  in  an  arbitrary 
time  period  of  length  Ts  in  which  the  i*h  subsystem  ex¬ 
periences  one  or  more  failures;  given  that  it  was  non- 
f ailed  at  the  start  of  the  time  period 

Dj  =  Number  of  reporting  time  periods  during  the  arbitrary 
time  period  Ts  that  the  i*h  subsystem  was  reported 
nonf ailed  for  the  entire  time  period  t, 

2)  Reliability  Trend  Index  of  one  missile /launch  complex  for 
a  time  t  during  standby  without  guidance  handover 
capability 


r.  h  ■  n  h  m 

k  =  Number  of  subsystems 

3)  Reliability  Trend  Index  of  one  missile /launch  complex 
for  a  basic  time  period  t  during  standby  with  guidance 
handover  capability  to  any  of  "n1*  ground  guidance  centers, 
and  without  penalty  for  delayed  reaction 


R.'  M  *  Rg  M  pfR.i  H 

where, 

(22) 

Rg  (T1  ■ 1  -  -  Rg  H)n 

and, 

RgH-‘-^4r 

(23) 

(24) 

Guidance  System  Reliability  Trend  Index  for 
the  time  period  t 

Number  of  reporting  periods  of  length  t  during 
an  arbitrary  time  period  of  length  Tg  that  a 
typical  guidance  system  experiences  one  or  more 
failures;  given  that  the  guidance  system  was  non- 
failed  at  the  start  of  the  reporting  time  period  t 

D  =  Number  of  reporting  period  that  the  same  guidance 
®  system  was  reported  nonfailed  for  the  entire  period 
r  during  the  time  period  Tg 


Rg  M  * 
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4)  Reliability  Trend  Index  for  an  arbitrary  time  period  Ta 
is  the  probability  of  surviving  the  entire  interval  Ta  with- 
out  a  failure  occurrence,  in  contrast  to  the  probability 
of  success  in  any  single  sample  of  t,  which  is  given  by 
Equation  (1).  (For  example  t  =  1  day,  =  90  days, ) 

(a)  By  subsystem 


(b)  Total  system  without  guidance  handover  capability 


5)  Apparent  subsystem  failure  rates  during  standby 


\  .  =  Apparent  subsystem  failure  rate  in  failures  per 
81  unit  time  assuming  an  exponential  apparent- 
failure  distribution 

r  =  Basic  time  reporting  period  associated  with  the 
counts  hT  and 

hT,  =  [(See  subparagraph  1)  above] 

6)  Total  apparent  failure  rate  \  per  missile /launch  com¬ 
plex  during  standby 


k 


81 


(28) 


=  Total  missile /launch  complex  apparent  failure  rate 

k  =  Total  number  of  subsystems  in  one  missile /launch 
complex 
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b.  Apparent  Alert  Readiness  (Par)  of  a  Missile  /Launch  Complex 


Alert  readiness  is  the  probability  that  a  missile/launch  complex 
will  be  capable  of  responding  to  an  execution  directive  received  at  an  arbi¬ 
trary,  unknown  point  in  time.  It  is  therefore,  a  measure  of  the  average 
reliability  of  a  missile/launch  complex  during  the  standby  condition 
given  by 


P 


ar 


(1AS  +  V 


(29) 


T  =if  T  (30) 

r  n  i=  1  ri 


\  =  Total  apparent  failure  rate  per  missile /launch  complex 

T  =  Mean  missile /launch  complex  reported  downtime  per 
apparent  failure 

T  =  Duration  of  reported  downtime  on  i**1  occurrence 
ri 

n  =  Number  of  reported  downtimes 

4.  3.  1,  3  Launch  Countdown  Reliability  Trend  Index 

1)  Launch  Countdown  Reliability  Trend  Index  by  subsystem 
from  all  data  sources. 


(31) 


cd 


>]  = 


i=l 


cd. 

l 


(32) 


th 

N  =  Total  number  of  failures  of  the  i  subsystems 
Ci  during  countdowns 

M  =  Total  number  of  countdowns  during  which  i**1 
ci  subsystem  was  exercised 


> 
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2)  Overall  Countdown  Reliability  Trend  Index 


Pcd  •]  -  Rcd  H  Pcd  l"C] 


(33) 


4» 


cd 


H 


Sc 

T~ 

c 

t-t 


_  _ T'i 

Pcd  [t/Gl  =  1  -  e  C  fi  t  »  tr 

PCd[t/Gl,0jtStr 


(34) 


(35a) 

(35b) 


PcdJp>  t|=  Probability  of  completing  a  launch  count¬ 
down  successfully  in  a  time  "t"  or  less 

Rcd[Cl  =  Probability  of  completing  a  launch  countdown 
successfully  without  regard  for  reaction  time. 

P  ,  t/G|=  Probability  of  completing  a  launch  countdown 
c  in  time  "t"  or  less  given  that  it  is  a  successful 

countdown 


S  =  Number  of  launch  countdown  successes 
c 

T  =  Number  of  launch  countdown  trials 
c 

t  =  Minimum  reaction  time 
r 

t  =  Reaction  time  constant 
c 


To  determine  t  and  t  ,  first  rank  the  times  to  complete  successful 
countdowns  in  order  of  increasing  time, 


t  .  =  t  r  t  ,  z  t  t*  2  t.  *  t 

min  n  n-1  n-2  2  1  max 


(36) 


Associate  a  number  P^  with  each  HtH  as  follows 


^max  =  V 

P  a  -^V): 
n  n+1  > 

(Vr  p„-i  “  ST>: 

(tn-2;  Pn-2 

cu  f  CO 

kh 

II 

^2’  P2  = 

(37) 

(tl  =  tmin; 

pi  =  ^> 
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It  can  then  be  shown  that  a  least  mean  squared  estimate  of  the  values 

for  t  and  t  are  given  by 
r  c 


4,  3,  1.4  Flight  Reliability  Trend  Index 

1)  Total  Flight  Reliability  Trend  Index  from  flight  tests 


R 


sf 

^7 


Sf  =  Total  successful  flights 
T^  =  Total  flights 


(40) 


Place  confidence  limits  on  Equation  (40)  using  standard  tables. 


2)  Flight  Reliability  Trend  Index  by  subsystem 

k 

Rf  =  TT  R£  (41) 

i=l  l 


R£.  -  *  '  U7-  <42> 

1  f. 

1 

Nf  =  total  flights  of  the  i**1  subsystem  on  which  it 
i  failed 

=  total  flights  during  which  the  i**1  subsystem  was  exercised. 

i 


1 
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4,  3.  2  Qualifications  of  the  Interim  Models 


4.  3.  2,  i  Alert  Readiness  for  a  Continuous  Monitoring  Policy,  It  may  be 
shown*  that  a  system  which  is  governed  by  exponential  distributions  for 
failure,  perfect  repair,  failure  detection  and  false  alarm  exhibits  analert 
readiness  given  by  the  equation. 


where 

^  s  Failure  rate  associated  with  failures  that  are 
"detectable  in  principle  " 

X.  =  Failure  rate  associated  with  failures  that  are 
"inherently  undetectable  in  principle  " 

a  =  False  alarm  rate  associated  with  those 
c  characteristics  of  the  equipment  which  are 
continuously  monitored. 

K  =  Rate  of  restoration  of  equipment  to  the  non- 
c  failed  state,  assuming  that  failures  of  either 
class,  and  false  alarms,  are  treated  in  an 
equivalent  manner  (remove  and  replace) 

e  =  Rate  of  detection  of  true  failures  of  the 
"detectable  in  principle  "  class 


By  "detectable  in  principle"  it  is  meant  that  the  failure  belongs 
to  the  class  of  observable  failures.  By  "inherently  undetectable  in 
principle"  it  is  meant  that  failures  of  this  class  are  unobserved  by  the 
nature  of  the  monitoring  used.  Examples  of  this  class  of  failure  are 
pyrotechnics,  re-entry  vehicle  fusing  and  arming,  and  engine  firing. 


*A,J,  Monroe.  "Missile/Launch  Complex-As- A-  Unit  Models  for  the  he 
Determination  of  Weapon  System  Capability, "  STL  report  number  6301- 
6237-TU-OOO,  4  May  1962,  Pages  53-60. 


The  equation  for  alert  readiness  used  in  the  interim  model  isderived 
from  Equation  (43)  by  means  of  the  following  simplifying  assumptions: 


e 


Hence,  Equation  (43)  reduces  to 


(44) 


(45) 


The  total  effect  of  these  simplifying  assumptions  on  the  apparent 

value  of  alert  readiness  is  unknown.  However,  the  qualitative  effect  is 

easily  determined  by  inspection  of  Equation  (43).  The  parameters  X^  and 

a  have  the  same  order  of  effect  as  X,.  The  value  of  P  varies  linearly 
c  d  ar  7 

with  e  and  to  first  order,  hence  these  parameters  have  a  greater 
potential  influence  than  any  of  the  remaining  parameters. 

In  the  derivation  of  Equation  (43)  it  was  assumed  that  at  least  one 
characteristic  of  every  remove -and -replace  module  was  monitored.  For 
those  equipments  which  are  not  monitored  at  all,  Equation  (43)  reduces  to 
zero,  since  in  this  case 


X 

->  co  (46) 

Xd 

Accordingly,  actual  alert  readiness  may  differ  markedly  from 
apparent  alert  readiness. 

4.  3.  2,  2  Reliability.  Reliability  is  traditionally  defined  as  the  conditional 
probability  that  an  equipment  will  survive  a  specified  time,  given  that  it  is 
initially  nonfailed.  A  measure  of  greater  significance  for  the  Atlas  weapon 
system  is  the  total  probability 
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(47) 


P[G,Tj  =  P[G]P[Ts/G] 

p[g]  =  Probability  that  the  equipment  is  good  at 
entrance  to  T 

s 

P(" T  /Gl  ■  Probability  that  the  equipment  survives  T#, 

L  *  J  given  that  it  was  good  at  entrance  to  T# 

For  a  system  which  is  continuously  monitored,  and  for  which  the 
reliability  is  desired  at  a  random  point  in  time,  t  +  T 

s 


1 1  r+  —  C  a.  —  j.'Tl  — 

\  l 
u  +  si 

e  1 
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X,  %  i  1  ^ 

d  T  U  T  C 

xu  ( 

1  +1^1 

A  T  i 
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p  +  Q 

rc 

c+Xd' 

i  e  ) 

The  same  remarks  apply  to  this  equation  as  applied  to  alert  readi¬ 
ness. 


If  a  system  is  subjected  to  a  periodic  maintenance  policy  on  certain 
items,  then  the  reliability  of  each  of  those  items  is  given  by^ 


1*1  EP.  P 
T 

s  s 


f 


P  .  P  (1  -a 
dT  UT 


uJ'-V1-"’} 

‘j|,-PdT<1->tPdT  PdT 


(49) 


where; 


P,  =  P .  P.  P,  PJ  P  p  p  p  (50) 

aT  dT^  dT  dT  dT  ut  uT  u,,  u„ 


T  T  UT 

c,  -c2  T.  T,  Tc,  *c2 


T  T 


where  each  of  the  P.  in  Equation  (50)  is  given  by 


(51) 


A 

Pi=-  * 


-Mt> 


7 


Ibid,  page  46,  Equation  119 
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for  the  exponential  failure  distribution,  where 

I  -  Probability  that  a  repaired  or  replaced  item  is 
nonf  ailed 


H*2  =  Probability  that  a  repaired  or  replaced  item  con- 
c  tains  a  failure  of  the  "inherently  detectable  in 
principle"  class 

E  =  Probability  that  a  failure  of  the  "inherently  detect¬ 
able  in  principle"  class  will  be  caught  during  checkout 


a 


P 


d 


T 


c 


i 


Probability  that  nonfailed  items  will  be  rejected  during 
checkout  (false  alarm  probability) 

Probability  that  the  inherently  detectable  class  of  items 
will  survive  the  portion  of  checkout  prior  to  test 
decision 


P 


d 


T 

c 


2 


P 

u 


T 


c 


1 


Probability  that  the  inherently  detectable  class  of 
items  will  survive  the  portion  of  checkout  remaining 
after  the  test  decision  is  made,  given  that  they  pass 
the  test  (no  false  alarm). 

Probability  that  the  inherently  undetectable  class  of 
items  will  survive  the  portion  of  checkout  prior  to 
test  decision 


P 

u 


T 


c 


2 


Probability  that  the  inherently  undetectable  class  of 
items  will  survive  the  portion  of  checkout  remaining 
after  the  test  decision  is  made,  given  that  they  are 
not  false  alarmed. 


P.  =  Probability  that  the  inherently  detectable  class  of 

dT  items  will  survive  the  scheduled  alert  interval  T 


P 


u 


T 


8 


Probability  that  the  inherently  undetectable  class  of 
items  will  survive  the  scheduled  alert  interval  Tfl 


Probability  that  the  detectable  class  of  items  will 
survive  the  time  period 


P 


u 


T 


r 


Probability  that  the  undetectable  class  of  items  will 
survive  the  time  period 


Note  that  this  expression  exhibits  a  first  order  variation  with  \i j,  E, 

Pd  and  PUfr  .  In  short,  these  analogs  of  y,  , 

Ts  As  c 

same  relative  effect  on  the  system  reliability  calculations. 


\.t  and  K  have  the 
d  u 
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Whether  a  system  is  monitored  continuously  or  checked  out  periodi¬ 
cally,  there  will  be  a  first  order  dependence  upon  the  quality  of  the  test 
(E,  e)  and  on  test  coverage  (X.^,  P^).  The  extent  to  which  apparent  relia¬ 
bility  and  apparent  alert  readiness  should  be  degraded  to  obtain  the  true 
reliability  and  the  true  readiness  is  not  known.  Steps  should  be  taken  to 
obtain  numerical  estimates  of  E,  e,  and  in  order  that  the  degrada¬ 
tion  may  be  calculated. 

5,  CONCLUSIONS  AND  RECOMMENDATIONS 
5.  1  Conclusions 

The  interim  reliability  measurement  system  for  the  D- Series  Atlas 
described  herein  provides  a  means  of  assessing  reliability  trends  utilizing 
currently  available  data  sources.  It  provides  Reliability  Trend  Indices  to 
the  subsystem  level  for  the  principal  operating  modes  of  standby9  count¬ 
down,  and  flight  as  well  as  the  Apparent  Alert  Readiness  Probability  for 
the  weapon  system. 

A  comprehensive  reliability  measurement  system,  when  combined 
with  proper  engineering  evaluation,  will  prove  to  be  a  valuable  aid  in  dis¬ 
cerning  the  significance  of  problems  reported  by  the  using  command. 
Efficient  allocation  of  the  engineering  effort  toward  the  solution  of  such 
problems  will  be  possible,  thus  leading  to  an  improvement  of  the  weapon 
capability. 

This  reliability  measurement  system  will  provide  the  necessary 
factors  for  calculation  of  weapon  system  capability,  subject  to  the  limi¬ 
tations  indicated  below  in  the  event  that  such  a  calculation  is  required. 

Major  limitations  of  the  interim  system  are  the  following: 

a)  Since  it  does  not  take  into  account  such  factors  as 
running  time,  "false  alarm"  probability,  the  proba¬ 
bility  of  detecting  failures,  repair  effectiveness,  and 
test  coverage,  only  the  apparent  reliability  is  measured . 

b)  The  Reliability  Trend  Indices  are  carried  only  to  the 
subsystem  level. 

c)  Data  collection  will  be  extremely  cumbersome,  since  there 
is  no  central  point  where  all  reliability  data  are  routed. 


-35- 


d)  The  Flight  Reliability  Trend  Index  will  be  based  on  a 
limited  number  of  tests  since  no  additional  flights  will 
be  conducted  after  completion  of  the  Category  III 
program. 

e)  Subsystem  interactions  are  not  considered. 

The  limitations  discussed  herein  can  be  overcome  through  imple¬ 
mentation  of  the  following  recommendations. 

5.  2  Recommendations 

The  system  described  herein  should  be  inaugurated  on  an  interim 
basis,  as  a  major  step  toward  eventual  attainment  of  an  absolute  relia¬ 
bility  measurement  capability. 

Running  time  should  be  obtained  in  order  that  the  interim  reliability 
measurement  system  can  be  improved  to  provide  an  absolute  measure 
of  reliability,  as  opposed  to  a  Reliability  Trend  Index. 

Data  collection  and  routing  should  be  revised  so  that  all  reliability 
information  is  forwarded  to  a  central  location. 

Models  should  be  developed  to  a  greater  level  of  detail  and  reporting 
methods  should  be  revised  to  support  the  more  detailed  equations. 

DPL  and  countdown  data  should  be  collected  throughout  Operation 
Shakedown  in  accordance  with  the  format  proposed  herein. 

Analysis  of  controlled  weapon  system  exercises  should  be  conducted 
to  establish: 

a)  "False  alarm"  probability 

b)  Probability  of  calling  a  bad  system  good 

c)  Adequacy  of  test  coverage 

d)  Repair  effectiveness 

Periodic  and  cumulative  reports  in  the  format  of  Figure  5  should  be 
instituted  to  assure  proper  dissemination  of  reliability  data.  Major  areas 
requiring  engineering  action  will  thus  be  identified,  assuring  a  more 
effective  concentration  of  the  engineering  effort. 
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6.  DEFINITIONS  AND  SYMBOLS 
6.1  Definitions 


Alert  Readiness 

DPL 

EWO 

Launch  Countdown 

Periodic  s 
Reliability 

Reliability  Trend 
Index  (RTI) 

Standby 

Successful  Flight 

Successful  Launch 
Countdown 


The  probability  that  a  missile/launch  complex 
will  be  nonfailed  and  capable  of  entering  count¬ 
down;  given  that  a  launch  directive  is  received 
at  a  random  point  in  time  after  initial  installa¬ 
tion  and  checkout  (average  reliability  during 
standby) 

Dual  Propellant  Loading.  As  used  here,  a 
simulated  launch  countdown 

Emergency  War  Order  readiness.  A  missile/ 
launch  complex  is  in  EWO  if  there  are  no 
observed  failures  and  a  target  is  assigned 

The  act  of  advancing  an  alert  missile  from 
standby  through  the  point  of  liftoff 

Scheduled  time  periods  during  which  scheduled 
maintenance  occurs 

The  probability  that  an  initially  nonfailed  equip¬ 
ment  will  survive  a  specified  time  period  under 
specified  conditions 

An  empirical  measure  of  the  ability  of  the 
weapon  system  or  subsystem  to  survive  a 
specified  time  under  specified  conditions 
based  on  the  observed  ratio  of  successes  to 
trials  for  any  given  event  or  mode 

A  time  period  fixed  by  policy,  for  the  duration 
of  which  the  missile/launch  complex  is 
assigned  to  a  target.  If  may  be  interrupted 
either  periodically  for  scheduled  maintenance 
or  by  the  requirements  of  unscheduled  main¬ 
tenance 

A  flight  which  occurs  as  programmed  with 
impact  within  3  C.  E.P.  of  the  designated 
target  point 

A  launch  countdown  which  terminates  in  liftoff 
with  no  evidence  of  malfunction  at  that  time 


6.  2  Symbols 


D 


g 


D, 

1 


M. 

J 


N 

g 

N. 


N. 

l. 

J 


P 


ar 


for  guidance 

Number  of  reporting  time  periods  of  length  t  during  the 
arbitrary  time  period  Ts  that  the  i*h  subsystem  was  re¬ 
ported  nonfailed  for  the  entire  time  period  t. 

Total  number  of  launch  countdowns  and/or  DPL's  during 
which  operation  of  the  i^h  subsystem  was  demanded 

Total  successful  flights  of  the  i^  subsystem 


Total  flights  during  which  operation  of  the  i**1  subsystem 
was  demanded 

Total  number  of  the  j**1  exercise 

Total  number  of  failures  of  the  i**1  subsystem  in  launch 
countdowns  and/or  DPL's 

N^  for  guidance 

Number  of  time  periods  of  length  t  in  an  arbitrary  time 
period  of  length  Tg  that  the  i«*  subsystem  experiences 
one  or  more  failures,  given  that  it  was  nonfailed  at  the 
start  of  each  time  period  t 

Number  of  failed  exercises,  j,  attributable  to  the  i**1 
subsystem 

Apparent  alert  readiness  probability  for  a  continuous 
monitoring  policy,  without  regard  for  schedules, 
periodic  maintenance;  depth  of  monitoring  and  quality 
of  monitoring 

Launch  countdown  Reliability  Trend  Index  without  regard 
for  reaction  time 

Launch  countdown  Reliability  Trend  Index  accounting 
for  reaction  time 

Apparent  probability  of  completing  a  launch  countdown  in 
a  time  "t"  or  less,  given  that  the  countdown  terminates  in 
a  launch 

Flight  Reliability  Trend  Index 

Rfi  [  T^for  guidance 
i 
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Reliability  Trend  Index  for  the  ith  subsystem  during  the 
jth  exercise 

Reliability  Trend  Index  of  one  missile/launch  complex  for 
any  time  t  during  standby  without  guidance  handover 
capability 

Reliability  Trend  Index  of  one  missile/launch  complex  for 
any  time  period  t  during  standby  with  guidance  handover 
capability  to  any  of  "n"  ground  guidance  centers,  and 
without  penalty  for  delayed  reaction 

Reliability  Trend  Index  of  the  i^1  subsystem  for  any  time 
t  during  standby 

Number  of  launch  countdown  successes 
Total  successful  flights 
Reaction  time  constant 


Number  of  launch  countdown  attempts 


Total  number  of  flights 


Minimum  reaction  time 


Arithmetic  mean  of  reported  down  times 

th 

Duration  of  down  time  on  i  occurrence 


Scheduled  duration  of  standby 


Least  reporting  time  period  in  an  arbitrary  time  period 
of  length  T& 

Total  system  apparent  failure  rate  (consumption  rate) 
assuming  independent,  exponential  failure  distributions 
for  all  subsystems 

i*1  subsystem  failure  rate  assuming  an  exponential  failure 
distribution 


